ci(license-exceptions): harden decision-workflow parser and untrack stale site/exceptions.json

[jeefy]

Summary

While verifying the License Exception Decision workflow (the one that updates exceptions.json / CSV / SPDX when a decision label is applied), I found it has never actually executed — all 7 historical runs are skipped because the label guard didn't match until #69bbe5b. The parser and generator do work when dry-run offline, but two hygiene issues surfaced:

1. Parser: empty table cells shift columns

row.split('|').map(trim).filter(c => c) dropped blank cells, so a request with an empty Upstream URL column would put the Project Usage URL into packageUrl and the License into... the wrong field entirely (license would become the Purpose text). Now only the leading/trailing pipes are stripped and positions are preserved.

Also unwraps markdown links ([grafana/k6](https://github.com/grafana/k6) → bare URL) and <url> in the URL column, and only sets comment when non-empty.

Verified by extracting the exact github-script block from the YAML and running it against the real body of #1482 plus a synthetic table with an empty cell and no leading pipe.

2. site/exceptions.json was tracked but is a build artifact

pretest copies the canonical file in and posttest deletes it; the Netlify build overwrites it. The committed copy was stale (2026-06-01, 487 entries vs 494) and every npm test left the tree dirty. Removed and gitignored — app.js already falls back to ../exceptions.json.

4. Publish the canonical data URL

A downstream consumer was fetching site/exceptions.json via raw.githubusercontent.com (and therefore getting the stale copy). README now documents https://exceptions.cncf.io/{exceptions.json,CNCF-licensing-exceptions.csv,cncf-exceptions-current.spdx} as the URLs to consume, and netlify.toml adds Access-Control-Allow-Origin: * on those three files.

Before merging: repoint the downstream consumer to https://exceptions.cncf.io/exceptions.json — this PR removes the file it currently reads.

5. Assign generated PRs

Decision PRs stay as PRs (no auto-merge; the main ruleset requires a PR anyway) and are now assigned to @joannalee333 so they have an owner. #1512 was assigned manually.

Test plan

• Playwright E2E suite: 30/30 pass locally with site/exceptions.json removed
• node scripts/generate-all.js idempotent (no diff)
• Parser dry-run against [License Exception Request] [OpenTelemetry Demo] [AGPL-3.0-only] #1482 and synthetic edge-case rows
• First real end-to-end run: applied license-exception/not-eligible to [License Exception Request] [OpenTelemetry Demo] [AGPL-3.0-only] #1482 (decision by @joannalee333 on 2026-08-19) -> workflow succeeded and opened Record license exception decision (not-eligible) for OpenTelemetry (OpenTelemetry Demo, https://github.com/open-telemetry/opentelemetry-demo) (#1482) #1512 (not-eligible, 1 entry). That run exposed a third issue, also fixed here.

3. Generated commit lacks DCO sign-off

#1512 fails the repo's DCO check because the create-pull-request commit has no Signed-off-by. Added signoff: true.

Not addressed here

peter-evans/create-pull-request uses GITHUB_TOKEN, so the PRs it opens won't trigger validate-exceptions / E2E on themselves. Worth a PAT or GitHub App token as a follow-up.